JPWO2016030927A1 - Process analysis apparatus, process analysis method, and process analysis program - Google Patents

Abstract

The present invention relates to a process analysis apparatus that analyzes a process executed by an information processing apparatus and extracts cryptographic logic such as an encryption function and a decryption function used in the process. The process analysis apparatus includes an execution trace acquisition unit that acquires an execution trace of a process to be analyzed, a block extraction unit that extracts a block that is a processing unit indicating a loop structure from the execution trace, and input information and output information from the block. A block information extraction unit for extracting block information including the block information, and feature determination information for determining the feature of the input / output relationship of the block using the input information or output information of the block information, and using the feature determination information to generate a block A block information analyzing unit that analyzes the input / output relationship of the encryption function and determines the block indicating the characteristics of the input / output relationship of the encryption function or the decryption function as the encryption logic.

Description

  The present invention relates to a process analysis apparatus that analyzes a process executed by an information processing apparatus and extracts cryptographic logic such as an encryption function and a decryption function used in the process.

  In recent years, as a new security threat, a “targeted attack” called Advanced Persistent Threat (APT), which attacks persistently with a specific organization, has become apparent. In APT, malware is infected to a target organization terminal by mail, and the infected malware communicates with an external attacker's server to download a new attack program and transmit confidential information in the organization system. In order to detect the occurrence of such security incidents at an early stage and prevent the spread of damage, a Security Operation Center (SOC) service that monitors various logs of network devices and detects suspicious signs is required. On the other hand, when the occurrence of an incident is found, the organization must perform an incident response such as investigation of the cause and damage of the incident, examination of countermeasures, restoration of services, and implementation of measures for preventing recurrence. In addition, depending on the organization's customers and business partners, the organization needs to clarify what has been leaked and what has not been leaked.

  When an organization investigates the cause or damage of an incident, it analyzes logs generated by computers, servers, network devices, etc. and packets recorded on the network to find malware intrusion routes, infected terminals, information accessed, attackers Network forensics, which investigates commands from the Internet and information sent to the outside, plays an important role. However, recent malware uses encryption technology to conceal communication. For this reason, even if the organization performs network forensics, it is difficult to track what commands are sent from the attacker and what information is sent to the outside.

  In order to cope with this problem, it is necessary to find the encryption logic and key used by the malware to conceal the communication, and to decrypt the encrypted communication. In general, this task requires analyzing the malware program binaries. Many of the conventional cryptographic logic extraction methods, such as the malware analysis system disclosed in Patent Document 1, search for characteristics often found in cryptographic logic from execution traces when executing malware. Identify logic and keys. As techniques for analyzing binaries of malware programs, techniques disclosed in Non-Patent Documents 1 to 9 are known.

JP 2013-114637

Noe Lutz, Towards Revealing Attacker's Intent by Automatically Decrypting Network Traffic, Master Thesis MA-2008-08. Zhi Wang, Xuxian Jiang, Weidong Cui, Xinyuan Wang and Mike Grace, ReFormat: automatic reverse engineering of encrypted messages, Proceedings of the 14th European Conference on Research in Computer Security. Felix Matenaar, Andre Wichmann, Felix Leder and Elmar Gerhards-Padilla, CIS: The Crypto Intelligence System for Automatic Detection and Localization of Cryptographic Functions in Current Malware, Proceedings of the 7th and Unwanted Software (Malware 2012). Xin Li, Xinyuan WaInternational Conference on Malicious ng, Wentao Chang, CipherXRay: Exposing Cryptographic Operations and Transient Secrets from Monitored Binary Execution, IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING (preprint) 2012. Felix Grobert, Carsten Willems, and Thorsten Holz, Automated Identification of Cryptographic Primitives in Binary Programs, Proceedings of the 14th International Conference on Recent Advances in Intrusion Detection. Joan Calvet, Jose M. Fernandez, Jean-Yves Marion, Aligot: Cryptographic Function Identification in Obfuscated Binary Programs, Proceedings of the 19th ACM Conference on Computer and Communications Security, CCS 2012. Intel, Pin-A Dynamic Binary Instrumentation Tool, https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool Bitblaze, TEMU: The BitBlaze Dynamic Analysis Component, http://bitblaze.cs.berkeley.edu/temu.html Jordi Tubella and Antonio Gonzalez, Control Speculation in Multithreaded Processors through Dynamic Loop Detection, In Proceedings of the Fourth International Symposium on High-Performance Computer Architecture, pp. 14-23, 1998.

  In the prior art represented by Patent Document 1, many irrelevant logics are extracted as encryption logic candidates. Malware analysts have to exclude irrelevant logic by hand and have the problem of requiring a lot of time and effort. Therefore, a highly accurate cryptographic logic extraction method that suppresses the extraction of irrelevant logic is required.

  The present invention has been made to solve the above problems, and is used by malware by analyzing execution traces of malware based on the characteristics of cryptographic logic used by malware that encrypts files and communications. The purpose is to specify the cryptographic logic with high accuracy.

  In order to solve the problems described above, the process analysis apparatus of the present invention extracts an execution trace acquisition unit that acquires an execution trace of a process to be analyzed, and a block that is a processing unit indicating a loop structure from the execution trace. A block extraction unit, a block information extraction unit that extracts block information including input information and output information from the block, and features of input / output relationships of the blocks using the input information or the output information of the block information Block information that generates feature determination information for determining the block, analyzes the input / output relationship of the block using the feature determination information, and determines a block indicating the feature of the input / output relationship of the encryption function or the decryption function as encryption logic And an analysis unit.

  According to the present invention, the feature determination information for determining the feature of the input / output relationship of the block extracted from the execution trace is generated, the input / output relationship of the block is analyzed using this feature determination information, and the encryption function or the decryption function By determining the block showing the characteristics of the input / output relationship as the encryption logic, there is an effect that the encryption logic used by the malware can be specified with high accuracy.

1 is a configuration diagram illustrating a configuration example of a process analysis apparatus according to a first embodiment. 3 is a flowchart showing a flow of process analysis processing of the process analysis apparatus according to the first embodiment. It is a figure which shows an example of the definition list | wrist 105. FIG. It is a figure explaining an example of the data format which stores input information and output information. It is a figure which shows the characteristic of the printable character string which the input / output information of a cryptographic function contains. 1 is a configuration diagram illustrating a configuration example of a process analysis apparatus according to a first embodiment. It is a flowchart which shows the flow of the character string ratio determination process of the character string ratio determination part 160 which concerns on Example 1. FIG. It is a figure which shows the example of the character code table stored in character code table DB162. It is a figure which shows an example (the 1) of usage of the encryption function of malware. FIG. 6 is a configuration diagram illustrating a configuration example of a process analysis apparatus according to a second embodiment. 10 is a flowchart illustrating a flow of a decoding determination process of a data decoding unit 170 according to the second embodiment. It is a figure which shows an example (the 2) of usage of the encryption function of malware. FIG. 10 is a configuration diagram illustrating a configuration example of a process analysis apparatus according to a third embodiment. 10 is a flowchart illustrating a flow of data decompression determination processing of a data decompression unit 180 according to Embodiment 3. It is a figure explaining the basic definition of encryption. FIG. 10 is a configuration diagram illustrating a configuration example of a process analysis apparatus according to a fourth embodiment. 10 is a flowchart illustrating a flow of a virtual execution determination process of a virtual execution unit 190 according to a fourth embodiment. 14 is a flowchart illustrating a flow (first half) of a virtual execution analysis process of a virtual execution unit 190 according to a fourth embodiment. FIG. 10 is a flowchart illustrating a flow (second half) of a virtual execution analysis process of a virtual execution unit 190 according to Embodiment 4. FIG.

Embodiment 1 FIG.
FIG. 1 is a configuration diagram illustrating a configuration example of a process analysis apparatus according to the first embodiment.
1, the process analysis apparatus 100 includes an execution trace acquisition unit 110, a block extraction unit 120, a block information extraction unit 130, a block information analysis unit 140, and an analysis result output unit 150.

  The process analysis device 100 is a device for analyzing a binary of a malware program. For example, a CPU (Central Processing Unit) is connected to a ROM, RAM, communication board, display, keyboard, mouse, magnetic disk device via a bus. The process analysis apparatus 100 is configured by a computer connected to a hardware device such as. The process analysis apparatus 100 includes a virtual machine on the CPU and an execution environment that can execute a malware program.

  The execution trace acquisition unit 110 executes the execution file 101 to be analyzed on the execution environment of the virtual machine, and executes an execution trace 102 that is log information of the executed process and process information 103 that is various information related to the executed process. get.

  The block extraction unit 120 extracts blocks, which are basic components constituting the program, from the execution trace 102 acquired by the execution trace acquisition unit 110, and outputs a block list 104, which is a list of a plurality of extracted blocks. . In addition, the block extraction unit 120 extracts information necessary for block information analysis processing described later from each line of the execution trace 102 and outputs the definition list 105.

  The block information extraction unit 130 extracts block information including input / output information executed in the block from the execution trace 102, the block list 104, and the definition list 105, and outputs the block information list 106.

  The block information analysis unit 140 uses the block information list 106 output by the block information extraction unit 130 to analyze whether the analysis target block is a cryptographic logic and outputs an analysis result list 107.

  The analysis result output unit 150 outputs the contents of the analysis result list 107 analyzed by the block information analysis unit 140 to, for example, a display and displays it to the analyst.

Next, the process analysis processing of the process analysis apparatus 100 will be described using the flowchart of FIG.
FIG. 2 is a flowchart showing a flow of process analysis processing of the process analysis apparatus according to the first embodiment.

First, in step S110, the execution trace acquisition unit 110 executes the program of the execution file 101 to be analyzed in an analysis environment such as a virtual machine. The execution trace acquisition unit 110 monitors the process of the executed program and records the execution trace 102 of the process. As information recorded by the execution trace 102, for example, the following information is recorded.
-Address of executed instruction-Address of executed instruction (opcode, operand)
・ Accessed register and its value ・ Accessed memory address, its value, its mode (READ / WRITE)

  As a method for acquiring an execution trace, for example, there is a method using a Dynamic Instrumentation Tool such as Pin described in Non-Patent Document 7, or a method using an emulator such as TEMU described in Non-Patent Document 8. . The execution trace acquisition unit 110 acquires an execution trace based on these existing methods.

In addition, the execution trace acquisition unit 110 extracts, as process information 103, information on DLLs and functions loaded by the process that acquired the execution trace 102 simultaneously with the acquisition of the execution trace 102. For example, the following information is recorded in the process information 103.
-Base address of the process-Name, address, and size of the DLL loaded by the process-Name and address of the API exported by the DLL As an easy-to-understand example of the process information 103, the process loaded in the memory PE header.

Next, in step S120, the block extraction unit 120 extracts blocks, which are basic components constituting the program, from the execution trace 102. The block here is a function, a loop, a connected loop, or the like, and has the following information necessary to express them.
・ Block ID
-Block type-Block start address-Block end address-Instruction sequence in the block (taken from the memory image of the process)
The block extraction unit 120 manages the block information as a block list 104 for the plurality of extracted blocks.

Hereinafter, each piece of information representing a block will be described.
The block ID is set to a unique value in the block list. As the block type, the outermost logic (function, loop, connected loop) constituting the block is set. The block start address indicates from which address on the memory used by the process the block starts. The block end address indicates the address on the memory used by the process at which the block ends. The instruction sequence in the block is an instruction sequence existing in the range of the start address and the end address on the memory used by the process.

  The block extraction unit 120 specifies a function by tracking the relationship between a function call instruction such as “call” and a return instruction such as “ret” on the execution trace 102. In addition, the block extraction unit 120 identifies a loop by tracking repetition of an instruction pattern and backward jump (Backward Jump) on an execution trace. In addition, the block extraction unit 120 identifies the connected loops by tracking the input / output relationship between the loops on the execution trace. For extraction of the block list 104, for example, techniques disclosed in Non-Patent Documents 5, 6, and 9 can be used.

Further, in step S120, a definition list 105 is created as information necessary for the steps described later.
FIG. 3 is a diagram illustrating an example of the definition list 105.
As shown in FIG. 3, the definition list 105 is a table in which the following information is recorded while the block extraction unit 120 reads the execution trace 102 line by line.
-Line number of the execution trace-Address where the instruction executed on the same line is located-Storage area (register, memory) changed on the same line
New value / value size

Next, in step S130, the block information extraction unit 130 extracts block information from the execution trace 102 and the blocks (block list 104, definition list 105), and outputs the block information list 106. In this block information list 106, block information having the following information is registered as an element.
・ Block ID
・ Input information ・ Output information ・ Context

Hereinafter, each piece of information representing block information will be described.
The block ID is information for associating with a block registered in the block list 104.
Input information is information that satisfies the following conditions in the execution trace 102.
Information defined before execution of block Information read before being overwritten during execution of block Output information is information that satisfies the following conditions in the execution trace 102.
In the storage area (register, memory), the information context last written in the storage area during execution of the block is information for indicating when the block is executed in the execution trace 102.

  The details of the input information, output information, and context extraction processing will be described below.

First, input information is extracted as follows.
The block information extraction unit 130 analyzes the execution trace 102 line by line. It is assumed that the instruction address of the execution trace 102 of interest is included in the range of the start address and end address of any block B1 registered in the block list 104. The block information extraction unit 130 further analyzes the execution trace 102, and it is assumed that an instruction is executed at an address X in the range of the block B1, and a certain storage area is read by the instruction. Then, the block information extraction unit 130 analyzes the definition list 105 and confirms whether or not the storage area is WRITEed by an instruction executed within the range of the block B1 and before the address X. In the case where WRITE is not performed, the storage area is set as input information.

  If the adjacent memory area is read by the same instruction at the same address on the execution trace 102, it is highly likely that the memory area is accessed as a buffer. Therefore, the memory area is collectively used as input information. . That is, the input information is composed of the start address of the memory area, the size, and the stored byte string. In addition, “buffer” is recorded as the type of input information. For input information that is read by an instruction at the same address but whose value is counted up or down, the type of the input information is “counter”. The type of input information used for the loop end condition in the loop and the input information used for the initial value of the counter is referred to as “end condition”.

Next, output information is extracted as follows.
It is assumed that the block information extraction unit 130 is analyzing the execution trace 102 of a certain block B1. The block information extraction unit 130 further analyzes the execution trace 102, and it is assumed that the trace exceeds the range of the block B1. At this time, the block information extraction unit 130 analyzes the definition list 105, and uses the information written by the command executed in the range of the block as output information. If WRITE is performed a plurality of times in the same storage area, the execution trace 102 having the largest line number, that is, the latest one is used as the output information.

  As in the case of input information, if adjacent memory areas on the execution trace 102 are written by the same instruction at the same address, there is a high possibility that they are accessed as a buffer. And That is, the output information is composed of the start address, size, and stored byte string of the memory area. In addition, “buffer” is recorded as the type of output information. For output information that is WRITE by the instruction at the same address but whose value is counted up or down, the type of output information is “counter”. The type of output information used for the loop end condition in the loop and the output information used for the initial value of the counter is referred to as “end condition”.

Next, a data format for storing input information and output information will be described.
FIG. 4 is a diagram for explaining an example of a data format for storing input information and output information.
In FIG. 4, information relating to input information and output information includes a storage area (start address), a value (byte string), a size (byte), and a type of information.

Next, context extraction is performed as follows.
The context is for expressing the calling relationship (nesting relationship) of blocks. For example, B1, B2, B3, B4, B5, B6, B7, and B8 are blocks. At this time, B2 is executed after the execution of B1, B3 and B4 are executed in B2, and B5 is executed after the execution of B2. Furthermore, B6 is executed in B5, and B7 is executed in B6. Then, B8 is executed after the execution of B7 and B6 is completed.

  In the case of the block calling relationship described above, the contexts of B1, B2, B5, and B8 are expressed as 1, 2, 3, and 4, respectively. The contexts B3 and B4 executed in B2 are expressed as 2.1 and 2.2, respectively. Similarly, the context of B6 executed in B5 is expressed as 3.1. Further, the context of B7 executed in B6 is expressed as 3.1.1. By expressing the context in this way, even calls of the same block (same block ID) can be distinguished according to the call location.

  Note that the expression format of the context may be any expression format as long as it can express the calling relationship (nesting relationship) of the blocks.

In addition, while analyzing the execution trace 102, the block information extraction unit 130 determines whether the block has ended or whether a new block has been called in the block as follows.
When the execution trace 102 of a certain block is being analyzed, if an instruction other than a function call (eg, call or enter) (eg, jmp, jne, ret) is used to jump out of the block range, the end of the block is means.
-While the execution trace 102 of a certain block is being analyzed, if a function call (for example, call or enter) instruction is used to jump outside the block range, the block will not be terminated, and a new block will be created within the block. Is called.
-While analyzing the execution trace 102 of a block, if the execution trace 102 exceeds the block range in cases other than the above, it means the end of the block.

Next, the description returns to the flowchart of FIG.
In step S140, the block information analysis unit 140 analyzes the block information in the block information list 106 and identifies the encryption logic. In the block information analysis, the block information analysis unit 140 generates feature determination information for determining features of the input / output relationship of the block using the input information or output information of the block information, and uses the feature determination information. The input / output relationship of the block is analyzed, and the block showing the characteristics of the input / output relationship of the encryption function or the decryption function is determined as the encryption logic. The feature determination information generated by the block information analysis unit 140 and the encryption logic determination method using the feature determination information will be described in detail in Examples 1 to 4 to be described later. As a result of analyzing the block information, the block information analysis unit 140 outputs the analysis result list 107 including the determination result of the cryptographic logic.

Finally, in step S150, the analysis result output unit 150 organizes the analysis results based on the block list 104, the block information list 106, and the analysis result list 107, and outputs the following information.
・ Cryptographic logic start address ・ Input information (storage area, value, size)
-Output information (storage area, value, size)
・ Decryption logic start address

  As described above, in the first embodiment of the present invention, the feature determination information for determining the feature of the input / output relationship of the block extracted from the execution trace is generated, and the input / output relationship of the block is determined using this feature determination information. By analyzing and determining the block showing the characteristics of the input / output relationship of the encryption function or the decryption function as the encryption logic, there is an effect that the encryption logic used by the malware can be specified with high accuracy.

  Next, Examples 1 to 4 that specifically realize the first embodiment will be described below.

Example 1.
The input of the cryptographic function is usually plain text. On the other hand, the output of the cryptographic function is a random byte sequence. Therefore, there is a feature that the ratio of the printable character string is large in the input of the encryption function and the ratio of the printable character string is small in the output.
FIG. 5 is a diagram showing the characteristics of the printable character string included in the input / output information of the cryptographic function.
In Figure 5, a printable character string "Hello" is input, also, among the information output, "mute" is printable string, "-" indicates a character string non-printable ing. In the first embodiment, a description will be given of an embodiment in which the encryption logic is specified by using the feature of the printable character string included in the input / output information of the encryption function as the feature determination information.

FIG. 6 is a configuration diagram illustrating a configuration example of the process analysis apparatus according to the first embodiment.
6, the block information analysis unit 140 includes a character string ratio determination unit 160, a character code determination algorithm database (database is hereinafter referred to as DB) 161, and a character code table DB 162. The block information analysis unit 140 receives the block information list 106, performs a character string ratio determination process, and outputs an analysis result list 107. In addition, the character string ratio determination unit 160 determines the printable character string ratio for the input information of the block information input from the block information analysis unit 140, specifies the encryption logic, and the encryption including the specified encryption logic The logic list 1 (163) is output to the block information analysis unit 140.

  The character string ratio determination unit 160, the character code determination algorithm DB 161, and the character code table DB 162 may be provided inside the block information analysis unit 140.

Next, the flow of character string ratio determination processing according to the first embodiment will be described with reference to FIG.
FIG. 7 is a flowchart illustrating the flow of the character string ratio determination process of the character string ratio determination unit 160 according to the first embodiment.

  First, in step S1601, the character string ratio determination unit 160 initializes the encryption logic list 1 (163). The cryptographic logic list 1 (163) is a block information list 106 that stores block information that is determined as a cryptographic logic candidate by the character string ratio determination unit 160.

  Next, in step S1602, the character string ratio determination unit 160 confirms whether or not the next element (block information) is present in the block information list 106. If there is no block information of the next element, the process proceeds to No branch, and the process ends. On the other hand, if there is block information of the next element, the next element Bi is selected in step S1603.

In step S1604, the character string ratio determining unit 160 determines the ratio of printable character strings in the input information of the block information. Here, the printable character string is a printable character string composed of a chain of c characters ending with a carriage return character or a null character (null character). The character string ratio determining unit 160 determines the character code of the byte string set as the value for the input information in which “buffer” is set as the information type. In this character code determination, character code determination is executed using an algorithm registered in the character code determination algorithm DB 161. If the character code can be determined, the corresponding character code table can be acquired from the character code table DB 162 and the printable characters can be confirmed.
FIG. 8 is a diagram illustrating an example of a character code table stored in the character code table DB 162.
FIG. 8 shows an example in which character codes are stored in association with characters “A” to “Pa”.

  The character string ratio determination unit 160 calculates the printable character string ratio by dividing the sum of the character string lengths of the printable character strings obtained from the byte string of the input information by the byte string length. Note that the character string length is calculated assuming that a multibyte character is 2 bytes.

  In step S <b> 1605, the character string ratio determination unit 160 determines the ratio of printable character strings in the block information output information. The processing procedure here is the same as that in step S1604.

  In step S <b> 1606, the character string ratio determination unit 160 calculates an input printable character string ratio−output print character string ratio as a difference between the input and output printable character string ratios.

  In step S1607, if the difference calculated in step S1606 is greater than or equal to the threshold θ, the character string ratio determination unit 160 adds the block information Bi to the encryption logic list 1 (163). Note that the above c and θ are adjustable parameters.

  In step S1604, it is possible to perform a file type inspection of input information. If the input is a file of a known file format such as WORD or PDF, text information is extracted according to the file format, and a printable character string ratio is calculated only for the text information. By doing this, even if a file of a type that encodes text such as WORD or PDF in a special format is input information, the ratio of printable character strings of the input information can be calculated appropriately. The file type check can use a known tool.

Example 2
In some cases, a malicious program such as malware encodes encrypted data into printable data (for example, Base64 encoding) and then transmits the data to the Internet.
FIG. 9 is a diagram illustrating an example (part 1) of how to use a cryptographic function of malware.
FIG. 9 shows an example in which the malware encrypts a ciphertext obtained by encrypting a message with a cryptographic function and then transmits it on the Internet by HTTP transmission. Therefore, when the output information of a certain block is decoded using a known decoder (for example, a Base64 decoder) and decoding is successful, a block having output information equal to the decoded value is set as a candidate for the encryption logic. be able to. In the second embodiment, a description will be given of an embodiment in which the encryption logic is specified by using the feature of the encoding included in the input / output information of the encryption function as the feature determination information.

FIG. 10 is a configuration diagram illustrating a configuration example of the process analysis apparatus according to the second embodiment.
In FIG. 10, the block information analysis unit 140 includes a data decoding unit 170 and an encoding / decoding algorithm DB 171. The block information analysis unit 140 receives the block information list 106, performs a decoding determination process, and outputs an analysis result list 107. In addition, the data decoding unit 170 decodes the output information of the block information input from the block information analysis unit 140. If the decoding is successful, the block having the output information equal to the decoded value is encrypted. The encryption logic list 2 (172) including the candidate encryption logic is output to the block information analysis unit 140 as a logic candidate.

  The data decoding unit 170 and the encoding / decoding algorithm DB 171 may be configured to be provided inside the block information analysis unit 140.

Next, the flow of decoding determination processing according to the second embodiment will be described with reference to FIG.
FIG. 11 is a flowchart illustrating the flow of the decoding determination process of the data decoding unit 170 according to the second embodiment.

  First, in step S1701, the data decoding unit 170 initializes the encryption logic list 2 (172). The encryption logic list 2 (172) is a block information list 106 that stores block information that is determined by the data decoding unit 170 as a candidate for encryption logic.

  Next, in step S <b> 1702, the data decoding unit 170 confirms whether there is a next element (block information) in the block information list 106. If there is no block information of the next element, the process proceeds to No branch, and the process ends. On the other hand, if there is block information of the next element, the next element Bi is selected in step S1703.

  Next, in step S1704, the data decoding unit 170 decodes the output information of the block information by applying a known decoding algorithm. Known decoding algorithms are stored in the encoding / decoding algorithm DB 171. The data decoding unit 170 decodes the output information whose information type is “buffer”.

  In step S1705, the data decoding unit 170 determines whether the decoding has succeeded. If the data decoding unit 170 succeeds in decoding using any one of the decoding algorithms stored in the encoding / decoding algorithm DB 171, the data decoding unit 170 holds the decoding result and proceeds to step S 1707 by branching to Yes.

  In step S 1707, the data decoding unit 170 searches the block information list 106 for a block having output information that matches the decoding result held in step S 1705. In order to improve processing efficiency, the search target may be limited to blocks having a context older than the context of the block Bi. If the data decoding unit 170 finds a block Bj (i ≠ j) having output information that matches the decoding result as a result of searching the block information list 106, in step S1708, the data decoding unit 170 converts the block information of the block Bj into a cryptographic logic candidate. Add to list 2 (172).

Example 3 FIG.
A malicious program such as malware may compress the data before encrypting the data.
FIG. 12 is a diagram illustrating an example (part 2) of how to use a cryptographic function of malware.
In FIG. 12, before the message is input to the encryption function, the malware compresses the message with the compression function, and transmits the ciphertext obtained by encrypting the compressed data with the encryption function to the Internet by HTTP transmission. An example is shown. Therefore, when the input information of a certain block is decompressed with a known decompression algorithm (for example, zip, lzh), and the decompression is successful, the block can be made a candidate for the encryption logic. In the third embodiment, a description will be given of an embodiment in which cryptographic logic is specified by using the characteristics of compression processing included in the input / output information of the cryptographic function as feature determination information.

FIG. 13 is a configuration diagram illustrating a configuration example of the process analysis apparatus according to the third embodiment.
In FIG. 13, the block information analysis unit 140 includes a data decompression unit 180 and a compression / decompression algorithm DB 181. The block information analysis unit 140 receives the block information list 106, performs data decompression determination processing, and outputs the analysis result list 107. In addition, the data decompression unit 180 decompresses the input information of the block information input from the block information analysis unit 140. If the decompression is successful, the data decompression unit 180 sets the block as a candidate for the encryption logic, Is output to the block information analysis unit 140.

  The data decompression unit 180 and the compression / decompression algorithm DB 181 may be configured to be included in the block information analysis unit 140.

Next, the flow of data decompression determination processing according to the third embodiment will be described with reference to FIG.
FIG. 14 is a flowchart illustrating the flow of the data decompression determination process of the data decompression unit 180 according to the third embodiment.

  First, in step S1801, the data decompression unit 180 initializes the cryptographic logic list 3 (182). The cryptographic logic list 3 (182) is a block information list 106 that stores block information that is determined by the data decompression unit 180 as a candidate for cryptographic logic.

  Next, in step S1802, the data decompression unit 180 confirms whether there is a next element (block information) in the block information list 106. If there is no block information of the next element, the process proceeds to No branch, and the process ends. On the other hand, if there is block information of the next element, the next element Bi is selected in step S1803.

  In step S1804, the data decompression unit 180 decompresses the input information of the block information by applying a known decompression algorithm. Known decompression algorithms are stored in the compression / decompression decoding algorithm DB 181. The data decompression unit 180 decompresses input information whose information type is “buffer”.

  In step S1805, the data decompression unit 180 determines whether decompression has succeeded. If the data decompression unit 180 succeeds in decompression using any decompression algorithm stored in the compression / decompression decoding algorithm DB 181, the process proceeds to step S 1806 due to a Yes branch.

  Next, in step S1806, the data decompression unit 180 adds the block information of the block Bj to the encryption logic candidate list 3 (182).

Example 4
From the basic definition of encryption, it is obvious that the original message can be obtained by decrypting the ciphertext obtained by encrypting a certain message (plaintext) with a certain key with the same key. That is, if the encryption function, the decryption function, the key, and the plaintext are Enc, Dec, k, and m, respectively, m = Dec (k, Enc (k, m)) is established.
FIG. 15 is a diagram for explaining the basic definition of encryption.
In FIG. 15, encrypted by the key with the plain text "Hello", if you give the ciphertext "... dumb,", to decrypt the ciphertext "... dumb," in the same key, the original message It shows that the plain text "Hello" is obtained.
According to such a basic definition of encryption, a part of the output of a certain block f (assumed to be a ciphertext) is processed as part of the input of another block g, and the output of g is f. If it matches the input (assuming plaintext), it is highly possible that f is an encryption function and g is a decryption function. Therefore, if a pair of blocks is selected, and the input information and output information of these blocks are processed using the above basic definition of encryption, the pair of blocks can be made a candidate for the encryption logic. . In the fourth embodiment, an encryption logic is specified by finding a pair of blocks in which the relationship of the basic definition of the encryption is established by using the feature of the input / output information based on the basic definition of the encryption as the feature determination information. An example will be described.

FIG. 16 is a configuration diagram illustrating a configuration example of a process analysis apparatus according to the fourth embodiment.
In FIG. 16, the block information analysis unit 140 includes a virtual execution unit 190.
The block information analysis unit 140 receives the block information list 106, performs virtual execution determination processing, and outputs the analysis result list 107. Also, the virtual execution unit 190 performs virtual execution using the basic definition of encryption on the block pair using the input information and output information of the block information input from the block information analysis unit 140, and performs virtual execution. When the execution is successful, the pair of the same block is set as a candidate for the encryption / decryption function pair, and the encryption / decryption function pair list 191 including the encryption / decryption function pair as a candidate is output to the block information analysis unit 140.

  The virtual execution unit 190 may be configured to be provided inside the block information analysis unit 140.

Next, the flow of the virtual execution determination process according to the fourth embodiment will be described with reference to FIG.
FIG. 17 is a flowchart illustrating the flow of the virtual execution determination process of the virtual execution unit 190 according to the fourth embodiment.

  First, in step S1901, the virtual execution unit 190 creates a cryptographic logic list 4 by merging already extracted cryptographic logic candidates. As the encryption logic candidates that have already been extracted, for example, encryption logic lists 1 to 3 that are encryption logic candidates determined in the first to third embodiments are used. When the encryption logic list 4 is created, if there are duplicate encryption logic candidates, they are combined into one.

  Next, in step S1902, the virtual execution unit 190 initializes the analysis result list 107. The analysis result list 107 is a list including block information pairs determined by the virtual execution unit 190 as a pair of encryption logic and decryption logic.

  Next, in step S1903, the virtual execution unit 190 confirms whether there is a next element (block information) in the cryptographic logic list 4. If there is no block information of the next element, the process proceeds to No branch, and the process ends. On the other hand, if there is block information of the next element, the next element Bi is selected in step S1904.

  Next, in step S1905, the virtual execution unit 190 performs virtual execution analysis using the basic definition of encryption using the output information of the next element Bi. Details of the virtual execution analysis process will be described later.

  Next, in step S1906, the virtual execution unit 190 determines whether the virtual execution analysis result is Null. If the virtual execution analysis result is not Null, the process advances to step S1907 due to a No branch.

  In step S 1907, the virtual execution unit 190 registers the virtual execution analysis result in the analysis result list 107.

Next, the flow of the virtual execution analysis in step S1905 will be described in detail with reference to FIGS.
FIG. 18 is a flowchart illustrating the flow (first half) of the virtual execution analysis of the virtual execution unit 190 according to the fourth embodiment.
FIG. 19 is a flowchart illustrating the flow (second half) of the virtual execution analysis of the virtual execution unit 190 according to the fourth embodiment.

  In the virtual execution analysis in step S1905, block information Bi and an execution file to be analyzed are given as arguments to the virtual execution unit 190.

First, in step S201, the virtual execution unit 190 initializes an encryption / decryption function pair list.
Next, in step S202, the virtual execution unit 190 starts the process by executing the execution file 101 to be analyzed on the virtual environment, and suspends the process after a certain period.
Next, in step S203, the virtual execution unit 190 creates a snapshot of the same process. This is called snapshot 1.

  Next, in step S <b> 204, the virtual execution unit 190 confirms whether there is a next element (block information) in the block information list 106. If there is no block information of the next element, the process proceeds to a No branch. In step S222, the encryption / decryption function pair list is returned, and the process ends. On the other hand, if there is block information of the next element, the next element Bj is selected in step S205. It is also possible to check the context of the block Bi and the block Bj and select a block Bj that is not nested.

Next, in step S206, the virtual execution unit 190 restores the snapshot 1 of the process.
Next, in step S207, the virtual execution unit 190 injects an instruction sequence constituting the block Bj into the process. Specifically, the element corresponding to the block ID of the block information Bj is searched from the block list 104, and the instruction sequence and start address of the block are acquired. Then, the same instruction sequence is injected from the same start address of the same process.
Next, in step S208, the virtual execution unit 190 creates a snapshot of the same process. This is called snapshot 2.
Next, in step S209, the virtual execution unit 190 acquires Bj input information.

  Next, in step S210, the virtual execution unit 190 generates an input snapshot Iss from the input information of Bj and the output information of Bi. The input snapshot is information that becomes an input of a block to be executed. The input snapshot Iss is generated as follows. The block Bi has n pieces of output information, and is represented by O = {O1-On}. On the other hand, the block Bj has m pieces of input information, and is represented by I = {I1 to Im}. Assume that the input information with Oi ∈ O and the jth element of I replaced with Oi is Iss. The information to be exchanged is that whose input / output information type is “buffer”. In addition, it is also possible to preferentially select and replace information with similar sizes. Replacement is performed for values and sizes. In addition, replacement is performed so that the same Iss is not generated twice.

  Next, in step S211, the virtual execution unit 190 determines whether a new Iss has been generated. When a new Iss is not generated, the process proceeds to No branch, and step S204 is executed. On the other hand, when a new Iss is generated, the process proceeds to step S212, and the virtual execution unit 190 restores the snapshot 2 of the process, and reflects the Iss in the process in step S213. In reflecting Iss, the values of all input information in Iss are set in an appropriate storage area (register, memory).

  Next, in step S214, the virtual execution unit 190 sets the head address of the injected instruction sequence in the Instruction Register, and in step S215, resumes the process.

Next, in step S216, the virtual execution unit 190 monitors the execution address of the process and checks whether the execution address exceeds the range of the block Bj.
Next, in step S217, the virtual execution unit 190 determines whether or not the execution of the block has ended. If the monitored execution address exceeds the range of the block Bj, the virtual execution unit 190 determines that the execution of the block Bj has ended, and suspends the process in step S218.

  Next, in step S219, the virtual execution unit 190 compares the output information of the executed block Bj with the input information of the block Bi. Output information obtained by executing the block Bj is extracted from the memory of the suspended process based on the start address of the output information of the block Bj.

  Next, in step S220, the virtual execution unit 190 determines whether the output information of the block Bj matches the input information of the block Bi. If they match, the process proceeds to step S221 by a Yes branch, and the block Bi and the block Bi Bj is registered in the encryption / decryption function pair list as a pair of encryption logic and decryption logic.

  In step S207, the process may be executed up to the start address of the block instead of injecting the instruction sequence of the block. In that case, the process of the same step is not performed in step S214, and it is only necessary to resume the process in step S215.

  As described above, in the inventions according to the first to fourth embodiments, the feature determination information for determining the feature of the input / output relationship of the block extracted from the execution trace is generated, and the input / output of the block using the feature determination information. By analyzing the relationship and determining the block indicating the characteristics of the input / output relationship of the encryption function or the decryption function as the encryption logic, there is an effect that the encryption logic used by the malware can be specified with high accuracy.

100 process analysis device, 101 execution file, 102 execution trace, 103 process information, 104 block list, 105 definition list, 106 block information list, 107 analysis result list, 110 execution trace acquisition unit, 120 block extraction unit, 130 block information extraction Section, 140 block information analysis section, 150 analysis result output section, 160 character string ratio determination section, 161 character code determination algorithm DB, 162 character code table DB, 163 encryption logic list 1, 170 data decoding section, 171 encoding / decoding algorithm DB, 172 Encryption logic list 2, 180 Data decompression unit, 181 Compression / decompression algorithm DB, 182 Encryption logic list 3, 190 Virtual execution unit, 191 Encryption / decryption function pair list .

Claims (7)

An execution trace acquisition unit that acquires an execution trace of the process to be analyzed;
A block extraction unit for extracting a block which is a processing unit indicating a loop structure from the execution trace;
A block information extraction unit that extracts block information including input information and output information from the block;
Generate feature determination information for determining features of the input / output relationship of the block using the input information or the output information of the block information, and analyze the input / output relationship of the block using the feature determination information, A process analysis apparatus comprising: a block information analysis unit that determines a block indicating characteristics of an input / output relationship of an encryption function or a decryption function as encryption logic. A character string ratio determining unit that determines a printable character string ratio that is a ratio of printable character strings included in the input information or the output information of the block information;
The block information analysis unit includes, as the feature determination information, a first printable character string ratio of the input information determined by the character string ratio determination unit and a second printable character string ratio of the output information. The process analysis apparatus according to claim 1, wherein a difference is calculated, and when the difference is equal to or greater than a predetermined threshold, the block is determined to be cryptographic logic. A data decoding unit for decoding the output information of the block information;
The block information analysis unit generates a decoding result obtained by decoding the output information of the block information by the data decoding unit as the feature determination information, and the block having the output information that matches the decoding result is converted into a cryptographic logic The process analysis apparatus according to claim 1, wherein A data decompression unit for decompressing the output information of the block information;
The block information analysis unit generates a decoding result obtained by decompressing the output information of the block information by the data decompression unit as the feature determination information, and the block having the output information that matches the decoding result is converted into a cryptographic logic. The process analysis apparatus according to claim 1, wherein A virtual execution unit that inputs the output information of the block information to another block and executes processing of the other block;
The block information analysis unit generates an execution result obtained by executing the processing of the other block by the virtual execution unit as the feature determination information, and the block having the input information that matches the execution result is defined as a cryptographic logic. The process analysis apparatus according to claim 1 for determining. A process analysis method of a process analysis apparatus that analyzes a process to be analyzed and determines cryptographic logic,
An execution trace acquisition step in which an execution trace acquisition unit acquires an execution trace of the process to be analyzed;
A block extraction step for extracting a block which is a processing unit indicating a loop structure from the execution trace;
A block information extraction step for extracting block information including input information and output information from the block;
A block information analysis unit generates feature determination information for determining features of the input / output relationship of the block using the input information or the output information of the block information, and uses the feature determination information to input the block. A process analysis method comprising: a block information analysis step that analyzes an output relationship and determines a block indicating a characteristic of an input / output relationship of a cryptographic function or a decryption function as a cryptographic logic. On the computer,
An execution trace acquisition step for acquiring an execution trace of the process to be analyzed;
A block extraction step of extracting a block which is a processing unit indicating a loop structure from the execution trace;
A block information extraction step for extracting block information including input information and output information from the block;
Generate feature determination information for determining features of the input / output relationship of the block using the input information or the output information of the block information, and analyze the input / output relationship of the block using the feature determination information, A process analysis program for executing a block information analysis step for determining a block indicating a characteristic of an input / output relationship of an encryption function or a decryption function as encryption logic.

Images